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The Examiner has rejected CCaims 4-6, 8-9, 17-19. 21-22, and 2S under 35 U.S.a 
1 12, second paragraph, as being indefinite for failing to particularly point out and 
distinctly claim the subject matter which applicant regards as the invention. Regarding 
Claims 2-6, 9, 15-19 and 22, such rejection is avoided by virtue of the amendments made 
hereinabove. Regarding Claims 8 and 21, applicant respectfully disagrees with the 
Examiner's rejection, since the plain and ordinary meaning of the terms "signatures" and 
"obfuscations," as evidenced by dictionaries, are clearly different. 

The Examiner has further rejected Claims 1, 14, and 27 under 35 U.S.C. 102(e) as 
being anticipated by Bates, U.S. Patent No. 6,721,721. Applicant respectfully disagrees 
with this rejection, especially in view of the amendments made hereinabove. 
Specifically, the subject matter of Claims 2-6, and 9 et al. has been substantially 
incorporated into each of the independent claims. 

In the latest action, the Examiner argues that "Bates is directed at least in part to 
storing virus information in a virus database ABSTRACT; FIG 1 42] that is accessed by 
indexed -based and/or directory-based search engines." The Examiner goes on to rely on 
the following excerpt from Bates to support such assertion. 

"To support the searcti functionality described atoove, as well as 
to support additional virus checking and reporting functionality 
consistent with the invention, computer 30 utilizes a number of 
software components, including a search engine 4 0, a web crawler 
42, a virus check controller 44 and a virus database 4 6. 

Search engine 40 may be implemented using any number of known 
searching technologies^ including index-based search engines 
and/or directory-based search engines, both of which are well 
known in the art. Search engine 4 0, however, is extended to 
support the generation of display information for a result set 
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zhar is based at leas:: In part cri viru^ .status inf orrna cion 3t:or-ej 



in virus database 



(see col, 6, lines 55-65) 



Applicant respectfully disagrees vviUi ihis assertion. TJie indexed technique 
mentioned in the excerpt above relates to the mariner in which the search engine retrieves 
information from the uetAvork (i.e. the Internet, etc.), not the mamier in which the virus 
database is constmcted. This is further evidenced by the continued discussion in col. 7 in 
Bates. 



Thus, Bates merely suggests an inde.x-based search engine , not an index-based 
virus database. Further, such search engine of Bates merely performs index-based 
searching and then applies standard virus scanning techniques in generation of search 
results. This is in stark contrast to applicant's "combining the list of virus signatures into 
a tree of virus signatures," as claimed. 

The Examiner continues by asserting that "Official Notice is taken that indexes 
and directories are tree-structured (hierarchical). The Specification BACKGROU>fD 
provides further evidence of this." Again, applicant respectfully disagrees. First, 
applicant does not equate indexes with trees. Instead, applicant states that «[t)ree'-based 
indexes are one form of indexing and searching mechanism." This statement clearly 
implies that tree-structures are something more specific with respect to mere indexing. 

It appears that the Examiner has simply dismissed applicant's claim language 
under Official Notice. In response, applicant again points out the remarks above that 
clearly show the manner in which the claimed subject matter further distinguishes Bates. 
AppUcant thus fonnally requests a specific showing of the subject matter in ALL of the 
claims in any future action. Note excerpt from MPEP below. 



"If the applicant traverses such an [Official Notice] assertion 
the examiner should cite a reference in support of his or her 
position." See MPEP 214 4.03. 
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Thc hxnnn.ncr is reminded that n claim is anncipa.ed only if each and evc^^^ 
clement as set forth in ,he claim is found, either expressly or i^^erently described in a 
s.ngle prior art reference. Vercle.aai Bros. v. Unio. Oil Co. Of California, 8 14 F 2d 628 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). Moreover, the identical invention must b«' 
shown in as complete detail as contained in the claim. Richardson v. Suzuki Motor 
CO.S6S F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. Cir. 1989). The elements must be 
arranged as required by the claim. 

This criterion has simply not been met by the Bates reference. Despite the 
aforementioned paramount differences and in the interest of expediting the prosecution of 
the present application, applicant has incorporated into each of the pending independen, 
claims, the following subject matter of former Claims 2-6, and 9 et al.: 

"wherein the virus signatures each include a sequence of characters- 
wherein the tree includes a plurality of branches each including a s^juence of 
characters; 

wherein a portion of the branches corresponds to a plurality of the virus 

signatures; 

wherein the efficiency of the virus signature recognition is improved by reducing 

an amount of virus signature data that is compared against the data- 

wherein the branches include further sub-branches each corresponding to at least 

one virus signature; 

wherein the branches include upper branch portions and lower branch portions." 

Only applicant teaches and claims such a combination of features for providing a 
technique where the efficiency of the virus signature i^ognition is imp^ved by reducing 
an amount of virus signature data that is compared against the data. A notice of 
allowance or a specific prior art showing of each of the foregoing limitations in 
combination with the remaining claim elements, is respectfully requested 
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It IS funher noted that Ihe Examiners rejection of applicant's dependent claim^is 
replete with deficiencies. Just by way of example, the Examiner rejects applicant's 
claimed 'therein the characters of the tree of virus signatures are obfuscated to preveol 
detection by the comparison" (see Claim 8 et al.) under 103Ca) as being unpatentable over 
Bates, U.S. Patent No. 6,721,721, and Arnold et al., U.S. Patent 5,440,723. 

Apphcant respectfully disagrees with this assertion. It is noted that neither Bates 
nor Arnold make any mention of obfuscation, let alone "wherein the characters of the tree 
of virus signatures are obfuscated to prevent detection by the comparison," as claimed by 
applicant. 

Further, it appears that various other claims (e.g. Claims 10-13 et al., for example) 
have been dismissed without a specific prior art showing. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438(Fed.Cir.l991). 

Applicant respectfiilly asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art reference fails to teach or 
suggest all the claim limitations . A notice of allowance or a specific prior art showing of 
each of the foregoing limitations, in combination with the remaining claim elements, is 
respectfully requested. 
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Siill yet., applicant brings iheExaminer's attention to the JbJlowino subject mato 
in the added dependent cJaims, for full consideration: 

"wherein the obfliscation prevents accidental self-detection of the tree of vinis 
signatures" (see Claim 29); 

"wherein the obfuscation is accomplished utilizing an exclusive-OR operation" 
(see Claim 30); 

"wherein pre-processing is performed prior to use of the tree of virus signatures" 
(see Claim 31); 

"wherein the pre-processing includes finding a correct location in a file where a 
virus resides, decryption, and emulation" (see Claim 32); 

"wherein the virus signature recognition is improved since comparison of similar 
portions of the virus signatures with the data more than once is avoided" (see 
Claim 33); and 

"wherein a pointer associated with a node of the tree is removed, if only one 
pointer exists, and an internal data structure includes a flag to indicate such 
removal" (see Claim 34). 

A notice of allowance or a specific prior art showing of each of the foregoing 
limitations, in combination with the remaining claim elements, is respectfiilly requested. 

To this end, all of the pending independent claims are deemed allowable, along 
with any dependent claims depending therefrom. 

Reconsideration is respectfully requested. 
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In the event a leiephone conversarion vvouid expedite rhe prosecution of thi. 
appJ.cauon, d.e Examiner may re.ch the undersigned at (40S) 505-5100. Applicants ^s. 
enclosing a check to pay for the added claims. The Commissioner is authorized to cha^e 
any add.honal fees or credit any overpayn.ent to Deposit Account No. 50-1351 (Order ^ 
No. NAil?0I6). 



Respectfully submitted. 



P.O. Box 721120 

San Jose, CA 95172-1 120 

408-505-5100 




o. 41,429 
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